Skip to content

Commit

Permalink
Staging: rtl8192su: buffer overflow in r8192U_core.c
Browse files Browse the repository at this point in the history 
There was a buffer overflow in the original code.  rf_path was 2 and it should
have been only 0 or 1.

I don't have the hardware for this, so I can't test it.

Looking at the code, there are two almost identical sections for updating the
hal variables.  The first one was clearly wrong and had the array overflow as 
well.  The second one looked correct.  I decided to use the second section as
is except for whitespace changes.

The differences between the two original sections:
1)  The second one had more debug output.
2)  The second one looped over rf_path instead of corrupting data.
3)  The second one had these additional assigments.
                      if (rf_path == 0) {
                              priv->TxPowerLevelOFDM24G[i] = priv->RfTxPwrLevelOfdm1T[rf_path][i] ;
                              priv->TxPowerLevelCCK[i] = priv->RfTxPwrLevelCck[rf_path][i];
                      }

Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Jerry chuang <wlanfae@realtek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Mar 4, 2010
1 parent 00367a6 commit 88e05d8
Showing 1 changed file with 43 additions and 84 deletions.
127 changes: 43 additions & 84 deletions drivers/staging/rtl8192su/r8192U_core.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3359,6 +3359,46 @@ u8 rtl8192SU_BoardTypeToRFtype(struct net_device* dev, u8 Boardtype)
return RFtype;
}

void update_hal_variables(struct r8192_priv *priv)
{
int rf_path;
int i;
u8 index;

for (rf_path = 0; rf_path < 2; rf_path++) {
for (i = 0; i < 3; i++) {
RT_TRACE((COMP_INIT), "CCK RF-%d CHan_Area-%d = 0x%x\n", rf_path, i, priv->RfCckChnlAreaTxPwr[rf_path][i]);
RT_TRACE((COMP_INIT), "OFDM-1T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i, priv->RfOfdmChnlAreaTxPwr1T[rf_path][i]);
RT_TRACE((COMP_INIT), "OFDM-2T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i, priv->RfOfdmChnlAreaTxPwr2T[rf_path][i]);
}
/* Assign dedicated channel tx power */
for(i = 0; i < 14; i++) {
/* channel 1-3 use the same Tx Power Level. */
if (i < 3) /* Channel 1-3 */
index = 0;
else if (i < 9) /* Channel 4-9 */
index = 1;
else /* Channel 10-14 */
index = 2;
/* Record A & B CCK /OFDM - 1T/2T Channel area tx power */
priv->RfTxPwrLevelCck[rf_path][i] = priv->RfCckChnlAreaTxPwr[rf_path][index];
priv->RfTxPwrLevelOfdm1T[rf_path][i] = priv->RfOfdmChnlAreaTxPwr1T[rf_path][index];
priv->RfTxPwrLevelOfdm2T[rf_path][i] = priv->RfOfdmChnlAreaTxPwr2T[rf_path][index];
if (rf_path == 0) {
priv->TxPowerLevelOFDM24G[i] = priv->RfTxPwrLevelOfdm1T[rf_path][i] ;
priv->TxPowerLevelCCK[i] = priv->RfTxPwrLevelCck[rf_path][i];
}
}
for(i = 0; i < 14; i++) {
RT_TRACE((COMP_INIT),
"Rf-%d TxPwr CH-%d CCK OFDM_1T OFDM_2T= 0x%x/0x%x/0x%x\n",
rf_path, i, priv->RfTxPwrLevelCck[rf_path][i],
priv->RfTxPwrLevelOfdm1T[rf_path][i] ,
priv->RfTxPwrLevelOfdm2T[rf_path][i] );
}
}
}

//
// Description:
// Config HW adapter information into initial value.
Expand All @@ -3374,7 +3414,7 @@ rtl8192SU_ConfigAdapterInfo8192SForAutoLoadFail(struct net_device* dev)
struct r8192_priv *priv = ieee80211_priv(dev);
//u16 i,usValue;
//u8 sMacAddr[6] = {0x00, 0xE0, 0x4C, 0x81, 0x92, 0x00};
u8 rf_path, index; // For EEPROM/EFUSE After V0.6_1117
u8 rf_path; // For EEPROM/EFUSE After V0.6_1117
int i;

RT_TRACE(COMP_INIT, "====> ConfigAdapterInfo8192SForAutoLoadFail\n");
Expand Down Expand Up @@ -3454,42 +3494,7 @@ rtl8192SU_ConfigAdapterInfo8192SForAutoLoadFail(struct net_device* dev)
}
}

for (i = 0; i < 3; i++)
{
//RT_TRACE((COMP_EFUSE), "CCK RF-%d CHan_Area-%d = 0x%x\n", rf_path, i,
//priv->RfCckChnlAreaTxPwr[rf_path][i]);
//RT_TRACE((COMP_EFUSE), "OFDM-1T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i,
//priv->RfOfdmChnlAreaTxPwr1T[rf_path][i]);
//RT_TRACE((COMP_EFUSE), "OFDM-2T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i,
//priv->RfOfdmChnlAreaTxPwr2T[rf_path][i]);
}

// Assign dedicated channel tx power
for(i=0; i<14; i++) // channel 1~3 use the same Tx Power Level.
{
if (i < 3) // Cjanel 1-3
index = 0;
else if (i < 9) // Channel 4-9
index = 1;
else // Channel 10-14
index = 2;

// Record A & B CCK /OFDM - 1T/2T Channel area tx power
priv->RfTxPwrLevelCck[rf_path][i] =
priv->RfCckChnlAreaTxPwr[rf_path][index];
priv->RfTxPwrLevelOfdm1T[rf_path][i] =
priv->RfOfdmChnlAreaTxPwr1T[rf_path][index];
priv->RfTxPwrLevelOfdm2T[rf_path][i] =
priv->RfOfdmChnlAreaTxPwr2T[rf_path][index];
}

for(i=0; i<14; i++)
{
//RT_TRACE((COMP_EFUSE), "Rf-%d TxPwr CH-%d CCK OFDM_1T OFDM_2T= 0x%x/0x%x/0x%x\n",
//rf_path, i, priv->RfTxPwrLevelCck[0][i],
//priv->RfTxPwrLevelOfdm1T[0][i] ,
//priv->RfTxPwrLevelOfdm2T[0][i] );
}
update_hal_variables(priv);

//
// Update remained HAL variables.
Expand Down Expand Up @@ -3899,53 +3904,7 @@ rtl8192SU_ReadAdapterInfo8192SUsb(struct net_device* dev)
}

}
//
// Update Tx Power HAL variables.
//
for (rf_path = 0; rf_path < 2; rf_path++)
{
for (i = 0; i < 3; i++)
{
RT_TRACE((COMP_INIT), "CCK RF-%d CHan_Area-%d = 0x%x\n", rf_path, i,
priv->RfCckChnlAreaTxPwr[rf_path][i]);
RT_TRACE((COMP_INIT), "OFDM-1T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i,
priv->RfOfdmChnlAreaTxPwr1T[rf_path][i]);
RT_TRACE((COMP_INIT), "OFDM-2T RF-%d CHan_Area-%d = 0x%x\n", rf_path, i, priv->RfOfdmChnlAreaTxPwr2T[rf_path][i]);
}

// Assign dedicated channel tx power
for(i=0; i<14; i++) // channel 1~3 use the same Tx Power Level.
{
if (i < 3) // Cjanel 1-3
index = 0;
else if (i < 9) // Channel 4-9
index = 1;
else // Channel 10-14
index = 2;

// Record A & B CCK /OFDM - 1T/2T Channel area tx power
priv->RfTxPwrLevelCck[rf_path][i] =
priv->RfCckChnlAreaTxPwr[rf_path][index];
priv->RfTxPwrLevelOfdm1T[rf_path][i] =
priv->RfOfdmChnlAreaTxPwr1T[rf_path][index];
priv->RfTxPwrLevelOfdm2T[rf_path][i] =
priv->RfOfdmChnlAreaTxPwr2T[rf_path][index];
if (rf_path == 0)
{
priv->TxPowerLevelOFDM24G[i] = priv->RfTxPwrLevelOfdm1T[rf_path][i] ;
priv->TxPowerLevelCCK[i] = priv->RfTxPwrLevelCck[rf_path][i];
}
}

for(i=0; i<14; i++)
{
RT_TRACE((COMP_INIT),
"Rf-%d TxPwr CH-%d CCK OFDM_1T OFDM_2T= 0x%x/0x%x/0x%x\n",
rf_path, i, priv->RfTxPwrLevelCck[rf_path][i],
priv->RfTxPwrLevelOfdm1T[rf_path][i] ,
priv->RfTxPwrLevelOfdm2T[rf_path][i] );
}
}
update_hal_variables(priv);
}

//
Expand Down

0 comments on commit 88e05d8

Please sign in to comment.